GDPR – Control Mapping

This page shows which Wombat controls cover which requirements of GDPR.

Framework Control	Requirement	Wombat Controls	Severity	Pillar	Category
Art. 5(1)(a) – Lawfulness, fairness and transparency	Art. 5(1)(a) – Lawfulness, fairness and transparency	WAF-SOV-010	🟠	Sovereign Cloud	identity-access
Art. 5(1)(c) – Data minimisation	Art. 5(1)(c) – Data minimisation	WAF-SEC-130	🟠	Security	identity-access
Art. 5(1)(e) – Storage limitation	Art. 5(1)(e) – Storage limitation	WAF-SOV-030 · WAF-SOV-040	🟠	Sovereign Cloud	logging-monitoring, network-security
Art. 5(1)(e) – Storage limitation (data not kept longer than necessary)	Art. 5(1)(e) – Storage limitation (data not kept longer than necessary)	WAF-COST-040	🟠	Cost Optimization	identity-access
Art. 5(1)(e) – Storage limitation (logs containing personal data must not be kept indefinitely)	Art. 5(1)(e) – Storage limitation (logs containing personal data must not be kept indefinitely)	WAF-COST-070	🟡	Cost Optimization	logging-monitoring
Art. 5(1)(f) – Integrity and confidentiality	Art. 5(1)(f) – Integrity and confidentiality	WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-130 · WAF-SOV-060	🔴 🟠 🟡 🟢	Agentic, Security, Sovereign Cloud	agentic-governance, identity-access, logging-monitoring, reliability-design
Art. 9 – Special categories of personal data	Art. 9 – Special categories of personal data	WAF-SEC-130	🟠	Security	identity-access
Art. 17 – Right to erasure (cryptographic erasure via key deletion)	Art. 17 – Right to erasure (cryptographic erasure via key deletion)	WAF-SOV-050	🔴	Sovereign Cloud	encryption-key-management
Art. 17 – Right to erasure (lifecycle policies support GDPR deletion requirements)	Art. 17 – Right to erasure (lifecycle policies support GDPR deletion requirements)	WAF-COST-040	🟠	Cost Optimization	identity-access
Art. 17 – Right to erasure (must be able to delete data)	Art. 17 – Right to erasure (must be able to delete data)	WAF-SOV-100	🟡	Sovereign Cloud	logging-monitoring
Art. 20 – Right to data portability	Art. 20 – Right to data portability	WAF-SOV-100	🟡	Sovereign Cloud	logging-monitoring
Art. 22 – Automated individual decision-making	Art. 22 – Automated individual decision-making	WAF-AGN-080	🟠	Agentic	identity-access
Art. 24 – Responsibility of the controller	Art. 24 – Responsibility of the controller	WAF-SEC-090	🟡	Security	identity-access
Art. 25 – Data protection by design	Art. 25 – Data protection by design	WAF-AGN-040 · WAF-SEC-020 · WAF-SEC-040	🔴 🟠	Agentic, Security	identity-access, logging-monitoring
Art. 25 – Data protection by design and by default	Art. 25 – Data protection by design and by default	WAF-SEC-030 · WAF-SEC-130	🟠	Security	identity-access
Art. 28 – Processor	Art. 28 – Processor	WAF-SOV-080 · WAF-SOV-120	🟠 🟡	Sovereign Cloud	data-governance, logging-monitoring
Art. 28 – Processor obligations	Art. 28 – Processor obligations	WAF-SEC-110	🟠	Security	container-security
Art. 28 – Processor obligations including data return/deletion on termination	Art. 28 – Processor obligations including data return/deletion on termination	WAF-SOV-100	🟡	Sovereign Cloud	logging-monitoring
Art. 30 – Records of processing activities	Art. 30 – Records of processing activities	WAF-SEC-130 · WAF-SOV-010 · WAF-SOV-080	🟠 🟡	Security, Sovereign Cloud	identity-access, logging-monitoring
Art. 32 – Security of processing	Art. 32 – Security of processing	WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-AGN-110 · WAF-REL-130 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-040 · WAF-SEC-050 · WAF-SEC-060 · WAF-SEC-070 · WAF-SEC-080 · WAF-SEC-090 · WAF-SEC-110 · WAF-SEC-120 · WAF-SEC-130 · WAF-SEC-140 · WAF-SEC-150 · WAF-SEC-160 · WAF-SOV-070 · WAF-SOV-110	🔴 🟠 🟡 🟢	Agentic, Reliability, Security, Sovereign Cloud	agentic-governance, backup-recovery, container-security, encryption-key-management, identity-access, logging-monitoring, network-security, reliability-design
Art. 32 – Security of processing (access control)	Art. 32 – Security of processing (access control)	WAF-SOV-060	🔴	Sovereign Cloud	identity-access
Art. 32 – Security of processing (availability and resilience)	Art. 32 – Security of processing (availability and resilience)	WAF-SOV-030	🟠	Sovereign Cloud	logging-monitoring
Art. 32 – Security of processing (encryption)	Art. 32 – Security of processing (encryption)	WAF-SEC-030	🟠	Security	identity-access
Art. 32 – Security of processing (encryption as a technical measure)	Art. 32 – Security of processing (encryption as a technical measure)	WAF-SOV-050	🔴	Sovereign Cloud	encryption-key-management
Art. 32 – Security of processing (including integrity monitoring)	Art. 32 – Security of processing (including integrity monitoring)	WAF-SOV-040	🟠	Sovereign Cloud	network-security
Art. 32 – Security of processing (network security)	Art. 32 – Security of processing (network security)	WAF-SOV-090	🟠	Sovereign Cloud	identity-access
Art. 33 – Breach notification to supervisory authority	Art. 33 – Breach notification to supervisory authority	WAF-SEC-080	🟠	Security	identity-access
Art. 33 – Breach notification within 72 hours	Art. 33 – Breach notification within 72 hours	WAF-SEC-100	🟡	Security	identity-access
Art. 33 – Notification of personal data breach	Art. 33 – Notification of personal data breach	WAF-SOV-070	🟠	Sovereign Cloud	identity-access
Art. 33 – Personal data breach notification	Art. 33 – Personal data breach notification	WAF-SEC-160	🟠	Security	logging-monitoring
Art. 34 – Communication of breach to data subject	Art. 34 – Communication of breach to data subject	WAF-SEC-100	🟡	Security	identity-access
Art. 44 – General principle for transfers	Art. 44 – General principle for transfers	WAF-SOV-010 · WAF-SOV-020	🔴 🟠	Sovereign Cloud	identity-access
Art. 44-46 – Transfers to third countries	Art. 44-46 – Transfers to third countries	WAF-SOV-030 · WAF-SOV-040 · WAF-SOV-080 · WAF-SOV-090	🟠 🟡	Sovereign Cloud	identity-access, logging-monitoring, network-security
Art. 46 – Transfers subject to appropriate safeguards	Art. 46 – Transfers subject to appropriate safeguards	WAF-SOV-010	🟠	Sovereign Cloud	identity-access
Art. 46 – Transfers to third countries	Art. 46 – Transfers to third countries	WAF-SOV-020	🔴	Sovereign Cloud	identity-access
Art. 46 – Transfers with appropriate safeguards	Art. 46 – Transfers with appropriate safeguards	WAF-SOV-120	🟠	Sovereign Cloud	data-governance
Article 5(1)(e) – Storage limitation principle	Article 5(1)(e) – Storage limitation principle	WAF-SUS-050	🟡	Sustainability	backup-recovery
Article 5(1)(f) – Integrity and confidentiality	Article 5(1)(f) – Integrity and confidentiality	WAF-REL-040	🔴	Reliability	secret-management
Article 25 – Data protection by design and by default	Article 25 – Data protection by design and by default	WAF-SUS-050	🟡	Sustainability	backup-recovery
Article 32 – Security of processing (data availability)	Article 32 – Security of processing (data availability)	WAF-REL-040	🔴	Reliability	secret-management
Article 32 – Security of processing (resilience and recovery testing)	Article 32 – Security of processing (resilience and recovery testing)	WAF-REL-070	🟠	Reliability	backup-recovery
Article 33 – Notification of a personal data breach to the supervisory authority	Article 33 – Notification of a personal data breach to the supervisory authority	WAF-REL-060	🟠	Reliability	logging-monitoring

Framework Control

Requirement

Wombat Controls

Severity

Pillar

Category

Art. 5(1)(a) – Lawfulness, fairness and transparency

WAF-SOV-010

🟠

Sovereign Cloud

identity-access

Art. 5(1)(c) – Data minimisation

WAF-SEC-130

🟠

Security

identity-access

Art. 5(1)(e) – Storage limitation

WAF-SOV-030 · WAF-SOV-040

🟠

Sovereign Cloud

logging-monitoring, network-security

Art. 5(1)(e) – Storage limitation (data not kept longer than necessary)

WAF-COST-040

🟠

Cost Optimization

identity-access

Art. 5(1)(e) – Storage limitation (logs containing personal data must not be kept indefinitely)

WAF-COST-070

🟡

Cost Optimization

logging-monitoring

Art. 5(1)(f) – Integrity and confidentiality

WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-130 · WAF-SOV-060

🔴 🟠 🟡 🟢

Agentic, Security, Sovereign Cloud

agentic-governance, identity-access, logging-monitoring, reliability-design

Art. 9 – Special categories of personal data

WAF-SEC-130

🟠

Security

identity-access

Art. 17 – Right to erasure (cryptographic erasure via key deletion)

WAF-SOV-050

🔴

Sovereign Cloud

encryption-key-management

Art. 17 – Right to erasure (lifecycle policies support GDPR deletion requirements)

WAF-COST-040

🟠

Cost Optimization

identity-access

Art. 17 – Right to erasure (must be able to delete data)

WAF-SOV-100

🟡

Sovereign Cloud

logging-monitoring

Art. 20 – Right to data portability

WAF-SOV-100

🟡

Sovereign Cloud

logging-monitoring

Art. 22 – Automated individual decision-making

WAF-AGN-080

🟠

Agentic

identity-access

Art. 24 – Responsibility of the controller

WAF-SEC-090

🟡

Security

identity-access

Art. 25 – Data protection by design

WAF-AGN-040 · WAF-SEC-020 · WAF-SEC-040

🔴 🟠

Agentic, Security

identity-access, logging-monitoring

Art. 25 – Data protection by design and by default

WAF-SEC-030 · WAF-SEC-130

🟠

Security

identity-access

Art. 28 – Processor

WAF-SOV-080 · WAF-SOV-120

🟠 🟡

Sovereign Cloud

data-governance, logging-monitoring

Art. 28 – Processor obligations

WAF-SEC-110

🟠

Security

container-security

Art. 28 – Processor obligations including data return/deletion on termination

WAF-SOV-100

🟡

Sovereign Cloud

logging-monitoring

Art. 30 – Records of processing activities

WAF-SEC-130 · WAF-SOV-010 · WAF-SOV-080

🟠 🟡

Security, Sovereign Cloud

identity-access, logging-monitoring

Art. 32 – Security of processing

WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-AGN-110 · WAF-REL-130 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-040 · WAF-SEC-050 · WAF-SEC-060 · WAF-SEC-070 · WAF-SEC-080 · WAF-SEC-090 · WAF-SEC-110 · WAF-SEC-120 · WAF-SEC-130 · WAF-SEC-140 · WAF-SEC-150 · WAF-SEC-160 · WAF-SOV-070 · WAF-SOV-110

🔴 🟠 🟡 🟢

Agentic, Reliability, Security, Sovereign Cloud

agentic-governance, backup-recovery, container-security, encryption-key-management, identity-access, logging-monitoring, network-security, reliability-design

Art. 32 – Security of processing (access control)

WAF-SOV-060

🔴

Sovereign Cloud

identity-access

Art. 32 – Security of processing (availability and resilience)

WAF-SOV-030

🟠

Sovereign Cloud

logging-monitoring

Art. 32 – Security of processing (encryption)

WAF-SEC-030